Trusted Solaris Audit Administration

To Remove Free Space (Optional)

  1. As role admin, at label admin_low, unmount the audit partitions from the workstation by running the umount(1M) command.

    For example, on the audit file server egret:


    egret$ umount /etc/security/audit/egret
    egret$ umount /etc/security/audit/egret.1
    egret$ umount /etc/security/audit/egret.2
    egret$ umount /etc/security/audit/egret.3
    
  2. Reduce reserved filesystem space on each partition to 0% with the command tunefs -m 0.

    The security administrator sets the reserved filesystem space (called the minfree limit) in the audit_control(4) file.

    For example, on the audit file server egret:


    egret$ tunefs -m 0 /etc/security/audit/egret
    egret$ tunefs -m 0 /etc/security/audit/egret.1
    egret$ tunefs -m 0 /etc/security/audit/egret.2
    egret$ tunefs -m 0 /etc/security/audit/egret.3
    

    Similarly, on the workstation willet:


    willet$ umount /etc/security/audit/willet
    willet$ tunefs -m 0 /etc/security/audit/willet
    

    See the tunefs(1M) man page for more information on the advantages and disadvantages of tuning a file system.